Add read-only token permissions to GitHub Action workflows

[pnacht]

Description

As described in the issue below, this PR adds read-only token permissions to all GitHub Action workflows, including their respective templates.

close_stale_pull_requests.yml needs pull_request: write permissions, so those were granted at the job level, ensuring that any future jobs added to the workflow don't have that permission unnecessarily.

Related Issue(s)

Fixes #12717

Checklist

• "Backport to:" labels have been added if this change should be back-ported
• Tests were added or are not required
• Did the new or modified tests pass consistently locally and on the CI
• Documentation was added or is not required

[frouioui]

Hello Pedro and thank you for your first contribution. This looks good to me. However, I'll apply your change to even more workflows in a subsequent commit.

[GuptaManan100]

LGTM

[pnacht]

@frouioui thanks for the additional changes! I can't believe I missed so many workflows!

One question, though: why did you grant create_release.yml write-all permissions? Is it for the csexton/release-asset-action? Given that it authenticates using a secret token (not the workflow's normal token), I don't think that's necessary.

[frouioui]

One question, though: why did you grant create_release.yml write-all permissions? Is it for the csexton/release-asset-action? Given that it authenticates using a secret token (not the workflow's normal token), I don't think that's necessary.

Hello @pnacht! It seems like we are using the auto-generated GitHub Token that Actions gives us. I think we are required to have the GITHUB_TOKEN set to write if we want csexton/release-asset-action to write to our releases. I might be wrong, but their README is not mentioning anything special.

[frouioui]

Merging this now, we can always modify create_release.yml in a subsequent Pull Request if we are not agreeing.

[pnacht]

Hello @pnacht! It seems like we are using the auto-generated GitHub Token that Actions gives us.

Ah yes! I hadn't seen it called as secretes.GITHUB_TOKEN before, just as github.token (they're equivalent, I just hadn't seen the former), got confused.

I think we are required to have the GITHUB_TOKEN set to write if we want csexton/release-asset-action to write to our releases. I might be wrong, but their README is not mentioning anything special.

That Action doesn't specify anything, but similar actions only require

jobs:
  build:
    permissions:
      contents: write

It's also worth mentioning that csexton/release-asset-action is no longer actively maintained (csexton/release-asset-action#20). Here are some alternatives I've found:

• https://github.com/elgohr/Github-Release-Action
• https://github.com/softprops/action-gh-release
• https://github.com/ncipollo/release-action
• https://github.com/shogo82148/actions-upload-release-asset

Also, create_release.yml has the following:

    # TEMPORARY WHILE GITHUB FIXES THIS https://github.com/actions/virtual-environments/issues/3185
    - name: Add the current IP address, long hostname and short hostname record to /etc/hosts file
      run: |
        echo -e "$(ip addr show eth0 | grep "inet\b" | awk '{print $2}' | cut -d/ -f1)\t$(hostname -f) $(hostname -s)" | sudo tee -a /etc/hosts
    # DON'T FORGET TO REMOVE CODE ABOVE WHEN ISSUE IS ADRESSED!

The linked issue has been fixed.

[frouioui]

Hey @pnacht, thanks for reporting this! Do you mind opening an issue for this matter and assign it to me? I will take a look, we don't want to rely on unmaintained actions :)

[frouioui]

Also, create_release.yml has the following:

    # TEMPORARY WHILE GITHUB FIXES THIS https://github.com/actions/virtual-environments/issues/3185
    - name: Add the current IP address, long hostname and short hostname record to /etc/hosts file
      run: |
        echo -e "$(ip addr show eth0 | grep "inet\b" | awk '{print $2}' | cut -d/ -f1)\t$(hostname -f) $(hostname -s)" | sudo tee -a /etc/hosts
    # DON'T FORGET TO REMOVE CODE ABOVE WHEN ISSUE IS ADRESSED!

The linked issue has been fixed.

I'll open a PR now to remove this unnecessary bit of code.